google-docs-mcp-server

The project's README explicitly lists critical bugs that require manual fixes with security implications: 'Case-Insensitive Search Index Bug (search.ts)' could lead to incorrect deletions, and 'SQL Injection in Query (read.ts)' is marked as vulnerable to injection despite some sanitization attempts. These unaddressed vulnerabilities significantly lower the security score. Additionally, sensitive Google OAuth2 credentials are stored in `credentials.json` and `token.json` files locally; while a common pattern, their security depends entirely on the host environment's file system permissions.